KR100970218B1 - Apparatus for determining abnormal terminal and method thereof - Google Patents

Abstract

The present invention relates to an apparatus for determining an abnormal terminal, wherein the apparatus for determining an abnormal terminal includes a plurality of switches which respectively transmit an IP allocation request packet transmitted from at least one corresponding terminal, and the IP allocation request packet input during a first setting time. If there is an abnormal port whose number is greater than or equal to the first setting number, and if there is a router that stores abnormal port information for the abnormal port, and an abnormal terminal transmitting an IP allocation request packet having a second setting number or more during a second setting time, An intrusion prevention unit that stores abnormal terminal switch information including information of the abnormal terminal and information of a switch connected to the abnormal terminal, and reads the abnormal port information from the router and reads the abnormal terminal information from the intrusion prevention unit; The abnormal terminal switch information is read, and the abnormal terminal switch information is When it included in the port information, and the management node includes a special selection for determining the abnormal terminal with a special management node. As a result, the management of the special management terminal is made, the service quality is increased, and the customer's satisfaction is improved.

DHCP, Dynamic IP, Network Management, DHCP Server, DHCP Packet

Description

Device for determining abnormal terminal and its method {APPARATUS FOR DETERMINING ABNORMAL TERMINAL AND METHOD THEREOF}

The present invention relates to an abnormal terminal determination apparatus and a method thereof.

In general, the network management system (network management system) to monitor the network equipment or the network state being used to ensure a smooth operation. Such a network management device generally uses a simple network management protocol (SNMP), an internet control message protocol (ICMP), a command line interface (CLI), etc., by using an IP (Internet Protocol) address assigned to a network device connected to a network. After accessing the network equipment through the method, it collects the traffic amount and information necessary to monitor the operation status and performs the necessary network management operation.

IP addresses are generally divided into static and dynamic IP addresses.

Since a fixed IP address is an IP address that is not changed once assigned and is continuously maintained, a network management device may access a corresponding device through a predetermined IP address and perform network management operation whenever necessary. However, since the number of public IP addresses is finite, there is a problem that the number of public IP addresses that can be used is limited.

Therefore, a method of dynamically allocating an IP address whenever necessary within a limited number of public IP addresses is used. That is, each time the subscriber turns on to use the network equipment, a new IP address is assigned every time. At this time, since the IP address assigned to the network equipment is not fixed, this is called a floating IP address. Using these dynamic IP addresses only assigns IP addresses to the network devices you are currently using, so you can assign IP addresses to more devices than static IP addresses.

Dynamic host configuration protocol (DHCP) is used to assign these dynamic IP addresses.

Next, a process of allocating an IP address to a terminal by a DHCP server connected to a communication network such as the Internet network using the DHCP method will be described.

1 is a flowchart illustrating an operation between a terminal and a DHCP server for explaining a general dynamic IP address allocation process using a DHCP method.

First, the terminal 10 accesses a communication network and transmits a server search message (DHCP Discovery) to find a suitable DHCP server to the plurality of DHCP servers 20 (S101). At this time, the terminal 10 sends a MAC address, which is its own unique identification number, to a server discovery message (DHCP Discovery). In response to the server discovery message (DHCP Discovery) from the terminal 10, the DHCP server 20 that wants to assign an IP address transmits an address assignment message (DHCP Offer) including an assignable IP address to the terminal 10. Informs the terminal 10 that the server allocates its own IP address (S102). In this case, the number of the DHCP server 10 to be assigned an IP address may be at least one.

After receiving the address assignment message (DHCP Offer), the terminal 10 selects an IP address to be assigned and generates an address request message (DHCP Request) requesting the assignment of the selected IP address to all DHCP servers 10. (S103).

Accordingly, the DHCP server 10 selected by the terminal 10, that is, the DHCP server 10 that transmits an address assignment message (DHCP Offer) including an IP address selected by the terminal 10 is assigned an IP address. An address assignment confirmation message (DHCP Ack) indicating that the transmission is transmitted to the terminal 10 (S104). That is, the address assignment confirmation message (DHCP Ack) is transmitted only from the DHCP server 10 to which the IP address selected by the terminal 10 is assigned.

Therefore, as the address assignment confirmation message (DHCP Ack) is delivered, the state of the terminal 10 becomes a state in which communication is possible using an IP address included in the address assignment message (DHCP Offer).

Next, the terminal 10 assigned the IP address may use the IP address during the set lease time. When the first set time elapses from the lease time (for example, about 1 hour), for example, When about 50% of the lease time elapses, an address request message (DHCP Request) for extending the use of the currently used IP address is transmitted to the corresponding DHCP server 10 (S105).

When the use of the assigned IP address is still possible, the DHCP server 10 transmits an address assignment confirmation message (DHCP Ack) to the corresponding terminal 10 in response (S106) to confirm the reassignment of the terminal 10. Inform Therefore, the terminal 10 continues to use the floating IP address assigned from the DHCP server 20.

However, if the response message to the address request message (DHCP Request) of step S105, that is, the address assignment confirmation message (DHCP Ack) is not transmitted from the DHCP server 10, the terminal 10 is set to the second of the lease time When a time e.g., about 87.5% of the lease time has elapsed, an address request message (DHCP Request) for extending the lease time is once again broadcasted (S107). In this case, the address request message (DHCP Request) transmitted may include a MAC address indicating the location of the terminal 10.

If the use of the assigned IP address is still possible, the DHCP server 10 transmits an address assignment confirmation message (DHCP Ack) for approval of reassignment to the corresponding terminal 10 (S108).

However, when there is no response from the DHCP server 10 due to the down of the DHCP server 10, the terminal 10 receives a new IP address from another DHCP server and continues communication. That is, since the message is transmitted by broadcast in step S107, the terminal can be used by receiving a new IP address from another DHCP server that can be assigned an IP address.

The message of steps S101, S103 and S107 is a broadcast message, and the message of step 105 is a unicast message transmitted only to the corresponding DHCP server 110.

As such, a server discovery message (DHCP Discovery), an address assignment message (DHCP Offer), an address request message (DHCP Request), an address assignment confirmation message (DHCP Ack), and the like, transmitted between the DHCP server 20 and the terminal 10. When the terminal 10 is assigned a floating IP address by using a DHCP packet, which is an IP allocation request packet, the terminal 10 generally transmits a server discovery message (DHCP Discovery) and then generally increases the lease time. Two to three DHCP packets (DHCP Requests) are generated during the lease time and transmitted to the DHCP server 10.

However, when the IP allocation request is not made in a normal manner due to a problem such as a router or a LAN card, a DHCP packet generated by the terminal 10 and transmitted to the DHCP server 10, for example, a server search. The number of occurrences of a message (DHCP Discovery) or an address request message (DHCP Request) increases abnormally.

As a result, in order to process an abnormally increased amount of DHCP packets, the load of the corresponding network equipment is rapidly increased, the processing speed is lowered, and the service quality is degraded.

The technical problem to be achieved by the present invention is to enable the operator to know the abnormal terminal operating abnormally and easily.

Another technical problem to be achieved by the present invention is to improve the stability of a service that is reduced due to an abnormally occurring IP allocation request operation.

The apparatus for determining an abnormal terminal according to an aspect of the present invention is connected to the plurality of switches through a plurality of switches and ports which respectively transmit IP allocation request packets transmitted from at least one corresponding terminal, and for a first setting time. If the number of the IP allocation request packets input through the port is equal to or greater than the first set number, the router stores abnormal port information for the port, and is connected to the router and is equal to or greater than the second set number during the second set time. If an abnormal terminal for transmitting an IP allocation request packet exists, an intrusion prevention unit for storing abnormal terminal switch information including information of the abnormal terminal and switch information connected to the abnormal terminal, and reading the abnormal port information from the router. And read the information of the abnormal terminal and the abnormal terminal switch information from the intrusion prevention unit. When the abnormal terminal switch information is included in the abnormal port information, a special management terminal selecting unit for determining the abnormal terminal as a special management terminal is included.

The abnormal port information may include location information on the abnormal port and a list of switches connected to the abnormal port.

The intrusion prevention unit may determine the abnormal terminal as a special management terminal when the abnormal terminal switch information is included in the switch list.

Each IP allocation request packet transmitted from the router includes terminal switch information including a MAC address of a terminal generating an IP allocation request packet and switch information connected to the terminal, and the information of the abnormal terminal is the MAC address. It is good.

The apparatus for determining an abnormal terminal according to the feature may further include a warning unit outputting a warning signal based on the information of the abnormal terminal.

Preferably, the IP allocation request packet is a DHCP packet.

The first set number may be greater than or equal to the second set number.

The first set time and the second set time may be the same.

The router may be a service edge router, and the router may block transmission of the IP allocation request packet input through the abnormal port.

The intrusion prevention unit may block transmission of the IP allocation request packet generated in the abnormal terminal.

According to another aspect of the present invention, a method of determining an abnormal terminal includes determining whether a port of a service edge router in which the number of DHCP packets input from the terminal is greater than or equal to a first configuration number during the first configuration time exists; If there is a port of the service edge router in which the number of the DHCP packets input is equal to or greater than the first set number, storing the location information of the port and a list of switches connected to the port, and an intrusion connected to the service edge router. Determining whether there is a terminal generating a DHCP packet greater than or equal to a second set number during a second configuration time by using a DHCP packet input from the prevention unit; generating DHCP packets greater than or equal to the second configuration number during the second configuration time If the terminal exists, the terminal switch information connected to the information of the terminal and the terminal Storing the port information, reading the location information of the port, the switch list, reading the terminal information, and the terminal switch information, and determining whether the terminal switch information is included in the switch list. If is included in the switch list, determining the terminal as a special management terminal.

The abnormal terminal determination method according to the feature may further comprise the step of outputting a warning signal using the information of the terminal.

The information of the terminal may be a MAC address of the terminal included in the DHCP packet.

The first set time and the second set time may be the same.

According to another aspect of the present invention, there is provided a special management terminal screening apparatus, wherein port information of a router port through which a DHCP packet equal to or greater than a first set number is transmitted from a terminal side, a switch list connected to a port of the router, and a second setting during a first set time. Reads information of a terminal generating a DHCP packet of a second set number or more, and switch information of a switch connected to the terminal, determines whether the switch information is included in the switch list, and the switch information is If included in the switch list, the terminal is determined to be a special management terminal.

The terminal information may be a MAC address included in the DHCP packet.

The first set time may be the same as the second set time.

According to the present invention, an abnormally generated DHCP packet is blocked from being transmitted to a DHCP server, thereby protecting a user due to an abnormal IP allocation request.

In addition, a terminal which is likely to generate an abnormal DHCP packet is selected as a special management terminal and notified to the operator. Therefore, the operator not only cuts off the communication service to the special management terminal but also performs special management such as a terminal repair proposal or a replacement proposal of the network equipment mounted on the special management terminal. As a result, as long as there is a hardware problem as well as a software problem, the terminal is managed, and thus the service quality is increased, thereby improving customer satisfaction.

DETAILED DESCRIPTION Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art may easily implement the present invention. As those skilled in the art would realize, the described embodiments may be modified in various different ways, all without departing from the spirit or scope of the present invention. In the drawings, parts irrelevant to the description are omitted in order to clearly describe the present invention, and like reference numerals designate like parts throughout the specification.

Throughout the specification, when a part is "connected" to another part, this includes not only "directly connected" but also "electrically connected" with another element in between. .

Throughout the specification, when a part is said to "include" a certain component, it means that it can further include other components, without excluding other components unless specifically stated otherwise. Also, the term "part" or the like, as described in the specification, means a unit for processing at least one function or operation, and may be implemented by hardware, software, or a combination of hardware and software.

An abnormal terminal determination apparatus and method thereof according to an embodiment of the present invention will now be described in detail with reference to the accompanying drawings.

First, referring to FIG. 2, a structure of an abnormal terminal determining apparatus according to an embodiment of the present invention will be described. In comparison with FIG. 1, the same reference numerals are assigned to components that perform the same function, and detailed description thereof will be omitted.

2 is a block diagram of an abnormal terminal determination apparatus according to an embodiment of the present invention.

As shown in FIG. 2, the apparatus for determining an abnormal terminal according to the present embodiment may be connected to the terminal unit 100, the DHCP server 20, the L3 switch unit 300 connected to the terminal unit 100, and the L3 switch unit 300. Intrusion prevention system (ISP) 60 connected to the service edge router 40 and the DHCP server 20 through the connected service edge router 40, the Internet network 50, and the Internet. A special management terminal sorting unit 70 connected to the intrusion prevention unit 60 and the service edge router 40 through the network 50 and a warning unit 80 connected to the special management terminal sorting unit 70 are provided.

The terminal unit 100 includes a plurality of terminal groups 101-10n, and each terminal group 101-10n includes a plurality of terminals 10. In the present embodiment, the terminal 10 may be a desktop computer, a laptop, a mobile phone, etc. subscribed to the Internet through the Internet network. Each terminal 10 generates a DHCP packet such as a server discovery message (DHCP Discovery) and an address request message (DHCP Request) and transmits it to the DHCP server 20 in order to receive a dynamic IP.

The L3 switch unit 300 includes a plurality of L3 switch groups 301-30n, and each of the L3 switch groups 301-30n includes a plurality of L3 switches 30. Each L3 switch 30 is connected to a corresponding terminal group 101-10n through a communication network such as a LAN. The L3 switch 30 transmits a data packet transmitted from the service edge router 40, for example, a DHCP packet, to the corresponding terminal 10, and a data packet transmitted from the terminal 10, for example, DHCP. The packet is sent to the service edge router 40.

The service edge router 40 has a plurality of ports, and each port is physically connected to the corresponding L3 switch group 301-30n. The service edge router 40 performs data transmission between the intrusion prevention unit 60 and the L3 switch unit 300, for example, transmission of a DHCP packet through the Internet network 50. In addition, when the number of DHCP packets transmitted from the terminal 10 through the same port is greater than or equal to the set number, the service edge router 40 does not transmit the DHCP packets input through the corresponding port to the DHCP server 20. In this case, the service edge router 40 stores a port for receiving more than a predetermined number of DHCP packets, that is, a location information of the abnormal port and a list of the L3 switches 30 connected to the abnormal port, such as a memory (not shown). Store in Hereinafter, the location information of the abnormal port and the L3 switch list stored in the memory are referred to as abnormal port information.

The intrusion prevention unit 60 transmits a data packet transmitted from the terminal 10 through the Internet network 50, for example, a DHCP packet to the DHCP server 20 or a data packet transmitted from the DHCP server 20. For example, the DHCP packet is transmitted to the terminal 10. In addition, if the number of DHCP packets transmitted from the same terminal 10 is greater than or equal to a set number using the MAC address included in the DHCP packet, the intrusion prevention unit 60 may generate a DHCP server transmitted from the terminal 10. Do not send to 20. At this time, the intrusion prevention unit 60 is the information of the terminal 10 generating more than a predetermined number of DHCP packets, that is, the MAC address and information of the L3 switch connected to the terminal 10 (hereinafter referred to as 'abnormal terminal L3 switch information'). Are stored in a storage device (not shown) such as a memory.

Unlike in FIG. 2, the intrusion prevention unit 60 may be connected to the DHCP server 20 through network equipment such as an L4 switch. In this case, in addition to the DHCP server 20, various network equipment such as a control server and a web server may be connected to the L4 switch.

The special management terminal screening unit 70 periodically accesses the intrusion prevention unit 60 and the service edge router 40 through the Internet network 50, and the MAC address stored in the intrusion prevention unit 60 and the abnormal terminal L3 switch. Information and the abnormal port information stored in the service edge router 40 are read to determine the terminal that needs special management.

The warning unit 80 is provided with a warning light or an alarm bell operated by a control signal output from the special management terminal selecting unit 70 to inform the operator of a special management terminal that is likely to generate a DHCP packet abnormally.

Next, referring to FIGS. 3A to 3C, the service edge router 40, the intrusion prevention unit 60, and the service edge router 40 according to the embodiment of the present invention block the transmission of the abnormally generated DHCP packet and select the special management terminal. The operation of the special management terminal sorting unit 70 will be described.

3A is an operation flowchart of a service edge router according to an embodiment of the present invention, FIG. 3B is an operation flowchart of an intrusion prevention unit according to an embodiment of the present invention, and FIG. 3C is a special management terminal selector according to an embodiment of the present invention. Operation flow chart.

First, referring to FIG. 3A, an operation of the service edge router 40 that blocks abnormal DHCP packet generation will be described.

When the operation of the service edge router 40 is started (S10), the service edge router 40 reads the DHCP packet transmitted from the terminal side through each port (S11), and the corresponding L3 switch group 301-30n. Afterwards, the number of DHCP packets input to each port during the set time is counted (S12).

Then, it is determined whether the number of DHCP packets input to each port is greater than or equal to the set number (S13). For example, it is determined whether the number of DHCP packets input through each port is about 23 or more.

If there are more than about 23 ports in which the number of DHCP packets input during the setting time is about 1 second, the service edge router 40 determines that at least one terminal 10 generates an abnormally DHCP packet. . Therefore, the service edge router 40 determines the corresponding port as the abnormal port (S14), and stores the location information of the abnormal port and a list of the L3 switches 30 connected thereto as the abnormal port information in the storage device (S15).

Then, the service edge router 40 blocks the transmission of the DHCP packet transmitted from the corresponding L3 switch group 301-30n to the DHCP server side through the abnormal port (S16).

As a result, the DHCP packet generated from the terminal 10 connected to the corresponding L3 switch group 301-30n connected to the abnormal port is not transmitted to the DHCP server 20, so that a new dynamic IP allocation or dynamic IP reassignment operation is performed. Not done. Therefore, the terminal 10 connected to the L3 switch group 301-30n cannot use the communication service using the IP address.

As such, since the service edge router 40 blocks the abnormal IP allocation request operation by using the number of DHCP packets input to each port, the service edge router 40 reduces user inconvenience caused by abnormally generated DHCP packets.

Next, an operation of the intrusion prevention unit 60 that blocks abnormal DHCP packet generation will be described with reference to FIG. 3B.

When the operation is started (S20), the intrusion prevention unit 60 reads the DHCP packet transmitted from the terminal side through the Internet network 50 (S21), the number of DHCP packets transmitted from the terminal 10 during the set time Is counted for each terminal (S22).

At this time, the DHCP packet transmitted from the terminal side to the intrusion prevention unit 50 is transmitted to the intrusion prevention unit 50, the information of the corresponding network equipment, that is, the switch unit 30 and the service edge router 40, The MAC address of the terminal 10 generating the DHCP packet is included. Therefore, the intrusion prevention unit 60 determines the number of DHCP packets generated in each terminal 10 by using the MAC address included in the input DHCP packet.

Then, the intrusion prevention unit 60 determines whether the number of DHCP packets transmitted from the same terminal 10, that is, the number of DHCP packets having the same MAC address is greater than or equal to the set number (S23). For example, the intrusion prevention unit 60 determines whether the number of DHCP packets transmitted from each terminal 10 is about 15 or more.

If there is a terminal 10 that transmits about 15 or more DHCP packets during the set time of about 1 second, the intrusion prevention unit 60 determines that at least the terminal 10 generates an abnormally DHCP packet.

 Therefore, the intrusion prevention part 60 determines the said terminal 10 as an abnormal terminal (S24).

Next, the intrusion prevention unit 60 stores the MAC address for the abnormal terminal in the storage device (S25), and also stores the L3 switch information connected to the abnormal terminal 10 as the abnormal terminal L3 switch information in the storage device (S25). .

Then, the intrusion prevention unit 60 does not transmit the DHCP packet transmitted from the abnormal terminal 10 to the DHCP server 20 (S26). As a result, since the DHCP packet generated from the abnormal terminal 10 is not transmitted to the DHCP server 20, a new dynamic IP allocation or a dynamic IP reallocation operation is not performed. Therefore, the terminal is unable to use the communication service using the IP address.

In this way, the intrusion prevention unit 60 blocks an abnormal IP allocation request operation by using the number of DHCP packets generated from each terminal 10, thereby reducing user inconvenience caused by abnormally generated DHCP packets.

Next, with reference to Figure 3c will be described the operation of the special management terminal selection unit 70 for selecting the special management terminal that requires special management to inform the operator.

When the operation is started (S30), the special management terminal screening unit 70 periodically accesses the service edge router 40 through the Internet network 50, and has abnormal port location information and a list of L3 switches connected to the abnormal port. One or more port information is read, and the intrusion prevention unit 60 is accessed to read MAC address and abnormal terminal L3 switch information (S31 and S32).

Then, the special management terminal selector 70 determines whether the read abnormal terminal L3 switch information is included in the L3 switch list of the abnormal port information (S33). That is, it is determined whether the abnormal terminal generating about 15 or more DHCP packets per second transmits the DHCP packet through the L3 switch connected to the abnormal port.

When the abnormal terminal L3 switch information is included in the abnormal port information, that is, when it is determined that the abnormal terminal has performed data transmission through the L3 switch connected to the port from which DHCP packet transmission is blocked by the service edge router 40, The management terminal selector 70 determines that the cause of the abnormal port is likely to be an abnormal terminal. Therefore, the special management terminal screening unit 70 determines the abnormal terminal determined by the intrusion prevention unit 60 as a special management terminal, that is, a terminal requiring special management due to the high possibility of generating an abnormal DHCP packet (S34). ).

 Then, the special management terminal selector 70 outputs a warning signal to the warning unit 80 so that the operator can know the terminal determined as the special management terminal.

As a result, the operator informs the user of the terminal that an abnormal DHCP packet is generated so that the user can take necessary measures such as replacing a LAN card or a router or repairing the terminal, and the terminal can be managed continuously by the operator. So that the service of other terminals is not adversely affected.

However, in step S33, when the abnormal terminal L3 switch information is not included in the abnormal port information, that is, the data through the L3 switch connected to the port where the abnormal terminal is blocked from DHCP packet transmission by the service edge router 40, If the transmission is not the case, the special management terminal screening unit 70 does not determine the abnormal terminal determined by the intrusion prevention unit 60 as the special management terminal (S300).

In this embodiment, the setting times of the service edge router 40 and the intrusion prevention part 60 are the same, but may be different from each other, and may be changed as necessary.

In addition, the number of settings of the service edge router 40 may be greater than or equal to the number of settings of the intrusion prevention unit 60, and the number of these settings may be changed according to the operation performance of the network equipment.

The embodiments of the present invention described above are not implemented only through the apparatus and the method, but may be implemented through a program for realizing a function corresponding to the configuration of the embodiment of the present invention or a recording medium on which the program is recorded. Implementation may be easily implemented by those skilled in the art from the description of the above-described embodiments.

Although the embodiments of the present invention have been described in detail above, the scope of the present invention is not limited thereto, and various modifications and improvements of those skilled in the art using the basic concepts of the present invention defined in the following claims are also provided. It belongs to the scope of rights.

1 is a flowchart illustrating an operation between a terminal and a DHCP server for explaining a general dynamic IP address allocation process using a DHCP method.

2 is a block diagram of an abnormality determination device according to an embodiment of the present invention.

3A is an operational flowchart of a service edge router according to an embodiment of the present invention.

3B is a flowchart illustrating an intrusion prevention unit according to an exemplary embodiment of the present invention.

3C is a flowchart illustrating an abnormal terminal discriminating unit according to an exemplary embodiment of the present invention.

Claims (18)

 A plurality of switches each delivering an IP allocation request packet transmitted from at least one corresponding terminal, A router that stores abnormal port information for the abnormal port when the abnormal port is connected to the plurality of switches through a port and the number of the IP allocation request packets input during the first configuration time is greater than or equal to the first configuration number. , The abnormal terminal switch information including the information of the abnormal terminal and the switch information connected to the abnormal terminal, if there is an abnormal terminal connected to the router and transmitting an IP allocation request packet equal to or greater than a second predetermined number during a second configuration time. Intrusion prevention unit to store, and If the abnormal port information is read from the router and the information of the abnormal terminal and the abnormal terminal switch information are read from the intrusion prevention unit, and the abnormal terminal switch information is included in the abnormal port information, special management of the abnormal terminal is performed. Special management terminal screening unit judging by terminal Abnormal terminal determination device comprising a. In claim 1, The abnormal port information includes the location information on the abnormal port and a list of switches connected to the abnormal port. In claim 2, And the intrusion prevention unit determines the abnormal terminal as a special management terminal when the abnormal terminal switch information is included in the switch list. 4. The method of claim 3, Each IP allocation request packet transmitted from the router includes terminal switch information having a MAC address of a terminal generating the IP allocation request packet and switch information connected to the terminal. The information of the abnormal terminal is the MAC address Abnormal terminal determination device. In claim 1, An abnormal terminal determination apparatus further comprises a warning unit for outputting a warning signal based on the information of the abnormal terminal. The method according to any one of claims 1 to 4,  And the IP allocation request packet is a DHCP packet. In claim 1, The apparatus for determining an abnormal terminal, wherein the first set number is greater than or equal to the second set number. In claim 7, The apparatus for determining an abnormal terminal, wherein the first setting time and the second setting time are the same. In claim 1, And the router is a service edge router. The method of claim 1 or 9, And the router blocks the transmission of the IP allocation request packet input through the abnormal port. The method according to any one of claims 1 to 3, The intrusion prevention unit abnormality terminal determination device for blocking the transmission of the IP allocation request packet generated in the abnormal terminal. Determining whether a port of a service edge router in which the number of DHCP packets input from the terminal side is greater than or equal to the first configuration number during the first configuration time exists; Storing the location information of the port and a list of switches connected to the port when there is a port of the service edge router in which the number of the DHCP packets input during the first configuration time is greater than or equal to the first configuration number; Using the DHCP packet input from the intrusion prevention unit connected to the service edge rounder, determining whether a terminal for generating a DHCP packet equal to or greater than a second set number during a second set time exists; Storing the terminal information and the terminal switch information connected to the terminal when the terminal generating the DHCP packet greater than or equal to the second predetermined number during the second configuration time exists; Reading the location information of the port, the switch list, the information of the terminal and the terminal switch information, and Determining whether the terminal switch information is included in the switch list, and if the terminal switch information is included in the switch list, determining the terminal as a special management terminal Abnormal terminal determination method comprising a. In claim 12, And outputting a warning signal by using the information of the terminal. In claim 12, And the terminal information is a MAC address of the terminal included in the DHCP packet. In claim 12, The method of claim 2, wherein the first set time and the second set time are the same. Port information of a router port through which a first set number or more of DHCP packets are transmitted from a terminal for a first set time, a list of switches connected to a port of the router, and a terminal for generating a second set number or more of DHCP packets during a second set time Information, and switch information of a switch connected to the terminal is read, it is determined whether the switch information is included in the switch list, and if the switch information is included in the switch list, the terminal is designated as a special management terminal. The special management terminal sorting apparatus to determine. The method of claim 16, And the terminal information is a MAC address included in the DHCP packet. The method of claim 16 or 17, And the first setting time is the same as the second setting time.

Images